CVE-2024-4630

🗓️ 14 May 2024 15:44:13Reported by [email protected]Type

The Starter Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_upload_mimes' function in versions up to 4.2.0 due to insufficient input sanitization and output escaping, allowing authenticated attackers to inject arbitrary web scripts

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin Starter Templates 安全漏洞	14 May 202400:00	–	cnnvd
CVE	CVE-2024-4630	11 May 202404:30	–	cve
Cvelist	CVE-2024-4630 Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	11 May 202404:30	–	cvelist
EUVD	EUVD-2024-44235	3 Oct 202520:07	–	euvd
Patchstack	WordPress Starter Templates plugin <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability	13 May 202401:16	–	patchstack
Patchstack	WordPress Starter Templates Plugin <= 4.2.1 is vulnerable to Cross Site Scripting (XSS)	13 May 202400:00	–	patchstack
Positive Technologies	PT-2024-31949 · WordPress · The Starter Templates — Elementor	11 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-4630	23 May 202508:41	–	redhatcve
Vulnrichment	CVE-2024-4630 Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	11 May 202404:30	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (May 6, 2024 to May 12, 2024)	16 May 202413:04	–	wordfence

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/astra-sites/tags/4.2.0/inc/importers/wxr-importer/class-astra-wxr-importer.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/25edb9e8-65ea-41d1-a95f-09be110ec1d2
plugins	www.plugins.trac.wordpress.org/changeset/3084334/

15 Apr 2026 00:35Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.4

EPSS0.00148

CWE-79